I just saw this link from a SANS email;

http://archives.neohapsis.com/archiv...3-06/0187.html

<extract>
The Sharp Zaurus is a linux-based PDA running Embedix. In the May
version of the Sharp Zaurus newsletter, version 3.1 of the flash
ROM was announced with various new versions of software and added
OS functionality. The linux kernel went from 2.4.6 to 2.4.18.

The Zaurus docking station comes with a USB connection, perceived
as a network interface both by the Zaurus and the connected PC.
An added feature with the new ROM version is that as you plug the
Zaurus into the docking station a Samba server is automatically
started. This by default gives read/write access to all documents
stored on the device without authentication. I have not found this
feature documented anywhere.


This Samba server unfortunately listens on ALL active network
interfaces with no restrictions that I have been able to determine
on who gets to connect. I have successfully mounted both over
802.11b and regular LAN.
</extract>

Anyone know if this affects other ROM versions and if this is really going
to cause problems for a casual user?


JP

--
There are 10 types of people in this world
Those that understand binary and those that don't

On Mon, 30 Jun 2003 10:12:47 -0700, JP wrote:

Like the (wo)man said, it's new in 3.10. It *might* be in the 5600 ROM,
also, though: 3.10 is, to a large extent, a "catch-up release" to
bring the 5500 to a comparable level.

Probably. I can't believe those dimwits went and did that after the flak
they got over the port 4242 exposure. As Ben Franklin would've said:
those who give up fundamental security for a little convenience deserve
neither ;-)

The problem may go away if you have the USB interface set up for TCP/IP
networking: I haven't verified it, but I think that disables the Samba
server.

Ran

This "problem" does exist on the 5600, personally I like being able to
conect to the Z using this, Z File Tranfer app is gludy. Only concern one
may have is that if you have the LAN card in and active while in the cradle
it does allow for open access to the Z over the wireless connection the
"problem" does not exist when you are only on the LAN . The problem exists
in either USB or USB w/ TCP/IP dock config.
Apperently (I have not tested this) if you apply Sharps syncpatch it
resolves the problem of the Z being accessable to the LAN while in the dock.
(See the Sharp DevNet forum more info and access to this patch).

Hope this answers some questions,

Jim

"Ran Talbott" <ran@netgate.net> wrote in message
newsan.2003.06.30.16.00.18.879140.14549@netgate. net...

Using the USB cradle in TCP/IP Advanced mode doesn't eliminate the breech.
One can still mount /home/samba on his Windows PC (or any other computer
probably) just by accessing the Zaurus's IP address. Oh, and it's also not
too difficult to create .zroot as a symbolic link to the root directory.
*sigh* Just make sure your Internet firewall is up.


"Ran Talbott" <ran@netgate.net> wrote in message
newsan.2003.06.30.16.00.18.879140.14549@netgate. net...

"Ran Talbott" <ran@netgate.net> wrote in message
newsan.2003.06.30.16.00.18.879140.14549@netgate. net...
There's a patch ipk to ensure it only accepts connections via the USB
interface. Plus if you're really paranoid, apart from the fact they haven't
supplied smbadduser or smbpasswd, it's still a standard samba install and
you can tweak smb.conf to tighten it down to your hearts content.

While it was still shortsighted of them to not password protect the Samba
server, it's not as bad as with the FTP server in the older ROMs as we can
at least make the hole so small that it's virtually impossible for someone
to obtain unauthorised access.

No it doesn't, quite the opposite in fact. But since the Zaurus will only be
using a private subnet by default, it won't be open to the entire world.